Historical provisional report. See the 6 September follow-up review for current findings and scoring.
SDK engineering review / 5 September 2026 / round 12
Verified improvements, with remaining gaps visible
8.1 / 10
Provisional assessment using round 11's five equally weighted categories. Previous independent baseline: 7.6/10. This is a self-review of the working tree, not an independent audit or certification.
| Category | Assessment |
|---|
| Security | 9.0/10 |
| Correctness | 8.5/10 |
| Architecture | 8.5/10 |
| Testing | 7.5/10 |
| Supply Chain And Ci | 7.0/10 |
| Overall | 8.1/10 |
The repository is not at 10/10. Passing the checks below does not close the provider, exception-handling, coverage, lint, checkout, or release-evidence gaps.
Implemented
- Reject empty/invalid allowlists and malformed list/type shapes without silently dropping constraints.
- Require every open mandate to carry an agent delegation key; compare kty, crv, x and y.
- Enable Kotlin ABI validation and store public ABI references.
- Remove unused upper-layer test dependencies from credential-api and did-core.
- Enable Kover in Kotlin modules and add merged CI reporting.
- Configure per-module CycloneDX SBOM attachments and remote-publication signing requirements.
- Add a release-evidence workflow and pin actions in the changed workflows to verified commit SHAs.
- Add status-list HTTP error-path tests and release-validation guidance.
The repository-wide coverage retry exposed an obsolete examples-module task-ordering cycle. The conflicting rule was removed; the subsequent run ended without a final result.
Verified evidence
888 tests passed; zero failures, errors, or skips across credential-api (400), did-core (453), Verifiable Intent (33), and the status-list server (2). These are targeted runs, not the complete SDK suite.
Generated 105 ABI reference files and passed the repository ABI checks. The documentation check examined 351 Markdown files with zero errors. Both changed workflow files parsed as YAML. Docker responded with server version 29.4.1.
CycloneDX generation passed with the corrected Maven artifact ID and 23 dependency components. Targeted line coverage: Verifiable Intent 724/852 (85.0%); status-list server 22/64 (34.4%).
Validation still pending
- Repository-wide coverage did not complete. The aggregate SBOM attempt was stopped while waiting on Maven metadata downloads; the module SBOM passed.
- Actual signed publication and hosted provenance attestation have not been exercised.
Remaining score deductions
- 19 included JVM-source modules still have no src/test Kotlin files; this inventory includes experimental/stub modules and is not a behavioral coverage measure.
- 32,692 existing lint-baseline entries remain; formatting this change does not remove the repository backlog.
- The prior exception-swallow finding needs a full case-by-case audit, including cancellation and network-error semantics.
- Autonomous checkout line-item enforcement and merchant-signed checkout verification remain incomplete; fail-closed behavior is retained.
- Hosted provider conformance, full regression/coverage validation, and actual release signing/provenance evidence remain required.
- Gradle reports deprecations that require attention before Gradle 10.
Review artifacts
Remediation evidence · Scores · Per-module inventory · Documentation check · Release-validation guide